lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 22 Dec 2022 08:38:00 +0100
From:   Sebastian Andrzej Siewior <>
To:     Kalle Valo <>
Cc:     Zhengchao Shao <>,,,,,,,,,,,,,,,,,,,,
Subject: Re: [PATCH] wifi: brcmfmac: unmap dma buffer in

On 2022-12-21 18:33:06 [+0000], Kalle Valo wrote:
> Zhengchao Shao <> wrote:
> > After the DMA buffer is mapped to a physical address, address is stored
> > in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in
> > brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr
> > and later unmap the DMA buffer. But when count is always equal to
> > pktids->array_size, physaddr isn't stored in pktids and the DMA buffer
> > will not be unmapped anyway.
> > 
> > Fixes: 9a1bb60250d2 ("brcmfmac: Adding msgbuf protocol.")
> > Signed-off-by: Zhengchao Shao <>
> Can someone review this?

After looking at the code, that skb is mapped but not inserted into the
ringbuffer in this condition. The function returns with an error and the
caller will free that skb (or add to a list for later). Either way the
skb remains mapped which is wrong. The unmap here is the right thing to

Reviewed-by: Sebastian Andrzej Siewior <>


Powered by blists - more mailing lists